4 ms·

As soon as we published a security.txt, we started received multiple beg bounties on a weekly basis. The thing is, that responding to them (regardless what you

by LeonM 5y ago

As soon as we published a security.txt, we started received multiple beg bounties on a weekly basis. The thing is, that responding to them (regardless what you write) often triggers a drip mail campaign with sad stories of how the 'hackers' are trying to pay for college, or their sick mother, or whatever typical scam story they can come up with. Within days you'll be sifting through dozens of emails, trying to find legit, serious reports. This increases the risk that you skim over a serious report. You now risk a reputation problem, because if you do not reply in a timely manner, some hackers will resort to publication as a way of public shaming. Please, if you are a legit white hat hacker, try to understand with how much junk reports we have to go through. Obviously, we want to credit real hackers :-) Anyway, we deleted our security.txt. This dropped the number of beg bounties significantly (no more automated emails). A real human hacker will find a contact address anyway.

mythz 5y ago
Unfortunately we also started receiving this claim shortly after creating a SECURITY page, based on this I've just decided to replace our email with a link to our online contact form so we can be reached without disclosing our Email, hopefully that is enough to prevent automated email systems.
twox2 5y ago
I've also had the experience of running a bug bounty program through a platform like Hackerone/Bugcrowd. It's the same exact shit. Awful.
tptacek 5y ago
I too don't think you should have a `security.txt`, but in, meh, 5 years of fielding bad bounty reports for various companies for various reasons, I've never seen someone appeal to their sick mother or their college fund. I usually get one additional ask after I say "no", and then they move on. I'm not sure I see the reputational risk you face here, since we all know the score on these reports. What are they going to do, tweet that you have an inadequate SPF record?
- LeonM 5y ago
  > What are they going to do, tweet that you have an inadequate SPF record? Heh, well, given that I run an e-mail hardening platform, our customers rely on our consulting on how to (amongst other techniques) set an adequate SPF record. So, in my specific case, this would actually be bad publicity. But what I meant was that for serious security issues, white hat hackers often do a writeup, as part of the public incident report. These often contain timelines. If it contains "contacted security@company.com, but got no response", this will make you look bad. This is what I meant with the reputation risk.
  - tptacek 5y ago
    I guess my point is that it's only a risk if they're finding real vulnerabilities, and if that's what they're doing, our sympathies should be recalibrated. (Obviously, I think it's most likely that they're not finding real bugs).
    - pgeorgi 5y ago
      The problem described is: - scammers blasting sob stories at the security contact - real security researcher finding something, reaching out to security@ - real researcher ending up in the spam bucket - real researcher complaining that they got no response
      - tptacek 5y ago
        That's not what's happening. If you're missing real bounty reports because you can't pick them apart from bogus SPF-type reports, that's on you. We've all had something like 10 years of experience fielding bounty reports and the one unmistakable dominant theme of everyone's experience with them is that almost all of the rando inbound reports are junk. Every competent security@ practice handles them just fine. It's annoying, but frankly what can you really expect? Bounties are spec work. I think spec work is fine, and that designers are mostly wrong about pushing back on it (it's a norm in all sorts of professions) but I'm sure as hell not going to get up on a high horse about the quality of my spec submissions. If I want to cultivate an expectation of high-quality reports, I retain consultants, or run a Google-style program with nosebleed-high payouts for sev:med bugs. The people we're talking about are spraying and praying for $50 bounties. They're not getting in the way of anyone's RCE report. The researchers who get no response from valid bugs are running into vendors who run bad software security practices. That's not the fault of low-skilled amateur researchers.
UncleMeat 5y ago
Worse, I've had a few of these beg bounties transition from sob stories to death threats after we rejected things again.
unclebucknasty 5y ago
>if you are a legit white hat hacker There's no such thing in my book. There are, however, legitimate security researchers and consultants. If you are one of these and have a service you want to provide, then get in touch with me like everyone else and make your pitch. Get my permission to provide your service, instead of just "providing" it then sending me what feels like extortion threats to buy it. I know that's not a popular opinion here, but IMO that idea is part of the problem, and exactly why the concept is so ripe for (and rife with) abuse.
- noodlesUK 5y ago
  I don’t know that I agree with looking at it that way. I find significant security vulnerabilities on sites from time to time (I have some modest security background but it isn’t my day job). I’m neither a security researcher or some kind of white hat hacker, just a concerned technically literate netizen. I have no interest in a bug bounty, I just want to see holes get patched. I’m not looking to provide some service, and I’m not actively probing for issues, I’m just letting people know that they’ve left their door open…
  - unclebucknasty 5y ago
    I hear you. But, I was referring to the term "white hat" in the context of this thread. Maybe I should've better clarified that. So, the activity you're speaking of isn't what I had in mind. If you've discovered something that you freely report to help operators secure vulnerabilities, then that's one thing. But, this "business" of targeting companies uninvited, then requesting payment creates shady scenarios at best. Many times, you have no idea who these people are or affiliated with, and whether they will exploit or sell this info on the black market if you don't pay them. You also don't know if it's the beginning of a drip, whereby they just continuously target you for one-off "payment requests" on other issues. There's very much a predatory feel about it. If people want to offer a service for something this sensitive, important, and reliant on trust, then come through the front door and be transparent about what your service provides and how much it costs.
Maxburn 5y ago
I was thinking about deploying some security.txt on our sites and your experience occurred to me, it is sort of like hanging a fishhook out there for all sorts of automated spamming.

by LeonM 5y ago

mythz 5y ago

Unfortunately we also started receiving this claim shortly after creating a SECURITY page, based on this I've just decided to replace our email with a link to our online contact form so we can be reached without disclosing our Email, hopefully that is enough to prevent automated email systems.

twox2 5y ago

I've also had the experience of running a bug bounty program through a platform like Hackerone/Bugcrowd. It's the same exact shit. Awful.

tptacek 5y ago

I too don't think you should have a `security.txt`, but in, meh, 5 years of fielding bad bounty reports for various companies for various reasons, I've never seen someone appeal to their sick mother or their college fund. I usually get one additional ask after I say "no", and then they move on. I'm not sure I see the reputational risk you face here, since we all know the score on these reports. What are they going to do, tweet that you have an inadequate SPF record?

LeonM 5y ago
> What are they going to do, tweet that you have an inadequate SPF record? Heh, well, given that I run an e-mail hardening platform, our customers rely on our consulting on how to (amongst other techniques) set an adequate SPF record. So, in my specific case, this would actually be bad publicity. But what I meant was that for serious security issues, white hat hackers often do a writeup, as part of the public incident report. These often contain timelines. If it contains "contacted security@company.com, but got no response", this will make you look bad. This is what I meant with the reputation risk.
- tptacek 5y ago
  I guess my point is that it's only a risk if they're finding real vulnerabilities, and if that's what they're doing, our sympathies should be recalibrated. (Obviously, I think it's most likely that they're not finding real bugs).
  - pgeorgi 5y ago
    The problem described is: - scammers blasting sob stories at the security contact - real security researcher finding something, reaching out to security@ - real researcher ending up in the spam bucket - real researcher complaining that they got no response
    - tptacek 5y ago
      That's not what's happening. If you're missing real bounty reports because you can't pick them apart from bogus SPF-type reports, that's on you. We've all had something like 10 years of experience fielding bounty reports and the one unmistakable dominant theme of everyone's experience with them is that almost all of the rando inbound reports are junk. Every competent security@ practice handles them just fine. It's annoying, but frankly what can you really expect? Bounties are spec work. I think spec work is fine, and that designers are mostly wrong about pushing back on it (it's a norm in all sorts of professions) but I'm sure as hell not going to get up on a high horse about the quality of my spec submissions. If I want to cultivate an expectation of high-quality reports, I retain consultants, or run a Google-style program with nosebleed-high payouts for sev:med bugs. The people we're talking about are spraying and praying for $50 bounties. They're not getting in the way of anyone's RCE report. The researchers who get no response from valid bugs are running into vendors who run bad software security practices. That's not the fault of low-skilled amateur researchers.

UncleMeat 5y ago

Worse, I've had a few of these beg bounties transition from sob stories to death threats after we rejected things again.

unclebucknasty 5y ago

>if you are a legit white hat hacker There's no such thing in my book. There are, however, legitimate security researchers and consultants. If you are one of these and have a service you want to provide, then get in touch with me like everyone else and make your pitch. Get my permission to provide your service, instead of just "providing" it then sending me what feels like extortion threats to buy it. I know that's not a popular opinion here, but IMO that idea is part of the problem, and exactly why the concept is so ripe for (and rife with) abuse.

noodlesUK 5y ago
I don’t know that I agree with looking at it that way. I find significant security vulnerabilities on sites from time to time (I have some modest security background but it isn’t my day job). I’m neither a security researcher or some kind of white hat hacker, just a concerned technically literate netizen. I have no interest in a bug bounty, I just want to see holes get patched. I’m not looking to provide some service, and I’m not actively probing for issues, I’m just letting people know that they’ve left their door open…
- unclebucknasty 5y ago
  I hear you. But, I was referring to the term "white hat" in the context of this thread. Maybe I should've better clarified that. So, the activity you're speaking of isn't what I had in mind. If you've discovered something that you freely report to help operators secure vulnerabilities, then that's one thing. But, this "business" of targeting companies uninvited, then requesting payment creates shady scenarios at best. Many times, you have no idea who these people are or affiliated with, and whether they will exploit or sell this info on the black market if you don't pay them. You also don't know if it's the beginning of a drip, whereby they just continuously target you for one-off "payment requests" on other issues. There's very much a predatory feel about it. If people want to offer a service for something this sensitive, important, and reliant on trust, then come through the front door and be transparent about what your service provides and how much it costs.

Maxburn 5y ago

I was thinking about deploying some security.txt on our sites and your experience occurred to me, it is sort of like hanging a fishhook out there for all sorts of automated spamming.